SugarCRM and badgeware licensing, again

Rick Moen [rick at linuxmafia.com]

Tue, 13 Jan 2009 01:35:16 -0800

By the way, I've just now reminded Bruce Perens of his kind offer, last
February, to let Prof. Moglen know about the latest SugarCRM ploy. I've
stressed that we'd be glad to hear any feedback, if Prof. Moglen has
time. I'll let LG know if/when I hear back.

To correct my below-quoted wording, strictly speaking, SugarCRM's latest
licensing doesn't literally replicate the "_exact same_ badgeware clause"
as in the prior proprietary licence, but it's really close: As written,
the licensing ends up requiring derivative works to display the firm's
trademarked logo or equivalent text (if technology used doesn't support
displaying logos) on _each and every user interface page_ of SugarCRM's
codebase that the derivative uses.

> > Zimbra is distributed under the Yahoo Public Licence, which isn't
> > listed on the OSI Web site.

That's because it's proprietary -- and because Zimbra (now Yahoo)
deliberately avoided submitting it for OSI certification, knowing it
would be denied.

> It is basically the MPL, and reasonably free, from my research.

It's a "badgeware" proprietary licence that deliberately impairs
third-party commercial usage through mandatory advertising notices
forced on third parties at runtime for all derivative works, one of a
series of such licences produced by Web 2.0 / ASP / Software as a Service
companies that carefully avoid seeking OSI licence certification,
because they know they can't get it. Non-free.

In YPL's case, the clause that makes it non-free is 3.2:

3.2 - In any copy of the Software or in any Modification you create,
You must retain and reproduce, any and all copyright, patent, trademark,
and attribution notices that are included in the Software in the same
form as they appear in the Software. This includes the preservation of
attribution notices in the form of trademarks or logos that exist within
a user interface of the Software.

> OTOH, not all components of Zimbra are covered under it, so the whole
> thing is kind of non-free, depending on your tastes.
>
> I believe the entire OS edition is freely available, though.

This is a very typical marketing tactic for badgeware: There is a
"public licence" (badgeware) version to entice new users, that's left
buggy, feature-shy, and poorly documented. If those users then try to
submit bugs, or request fixes, or inquire about customisations, the
sales staff then launches an all-out effort to upsell them to the
"commercial version". (***COUGH*** SugarCRM ***COUGH***).

> On Mon, 2009-01-12 at 07:52 -0800, Rick Moen wrote:
> > This is a very typical marketing tactic for badgeware: There is a
> > "public licence" (badgeware) version to entice new users, that's left
> > buggy, feature-shy, and poorly documented. If those users then try to
> > submit bugs, or request fixes, or inquire about customisations, the
> > sales staff then launches an all-out effort to upsell them to the
> > "commercial version". (***COUGH*** SugarCRM ***COUGH***).
>
> SugarCRM does deserve some credit, they have abondonded their MPL
> derived badgeware license for GPLv3. See
> http://www.sugarcrm.com/crm/products/new-in-sugar/sugar-5.0.html#Community

Were you aware of exactly how badly one can mislead people, by telling
the truth but omitting the most crucial facts? Now, of course, far be
it from yr. humble correspondent to impute an intent to mislead to
anyone without very strong evidence indeed. Absent that evidence, one
can only assume the most remarkably accidental mishap, instead.

* This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU General Public License version 3 as published by the
* Free Software Foundation with the addition of the following permission added
* to Section 15 as permitted in Section 7(a): FOR ANY PART OF THE COVERED WORK
* IN WHICH THE COPYRIGHT IS OWNED BY SUGARCRM, SUGARCRM DISCLAIMS THE WARRANTY
* OF NON INFRINGEMENT OF THIRD PARTY RIGHTS.
[etc.]

But hang on: What's this, just under the bit about "You should have
received a copy of the GNU General Public License..." and the paragraph
explaining how to write to SugarCRM, Inc. headquarters?

* The interactive user interfaces in modified source and object code versions
* of this program must display Appropriate Legal Notices, as required under
* Section 5 of the GNU General Public License version 3.
*
* In accordance with Section 7(b) of the GNU General Public License version 3,
* these Appropriate Legal Notices must retain the display of the "Powered by
* SugarCRM" logo. If the display of the logo is not reasonably feasible for
* technical reasons, the Appropriate Legal Notices must display the words
* "Powered by SugarCRM".

So, basically they've used a "legal notices" clause of GPLv3 to slide
the _exact same_ badgeware clause into the code that they had before.
Do they mention that they're not using GPLv3 but rather GPLv3 with a
modifier that causes their licensing to be proprietary, and not free
software at all? Not that I've seen.[1]

But I'm sure that that's absolutely coincidental. I mean, I wouldn't
want to accuse them of trying to fool anyone intentionally. I'm sure
they'll get around to making sure everyone knows they're still using the
same old proprietary licensing. Any day now.

Eleven months ago (last Feb. 11th), we editors of _Linux Gazette_
noticed this..., er,... unfortunate mishap, and, as we happened to be
discussing it with Bruce Perens, Bruce offered to call Prof. Moglen's
attention to it -- so that Prof. Moglen would realise that free
advertising like
http://www.businessweek.com/technology/content/jul2007/tc20070726_089940.htm
had probably been a mistake on his part.

I am uncertain whether Bruce in fact has yet spoken to Prof. Moglen.
However, I do hope he does, and that Prof. Moglen reconsiders the (in
effect) endorsement, which in my view SugarCRM has very much not
deserved.

[1] In the name of full disclosure, this trickery is mentioned in
passing in the "SugarCRM GPL v3 FAQ",
http://www.sugarforge.org/content/faq/gplv3.php, which claims that
"Sugar Community Edition conforms to the attribution provisions in GPL
v3 Section 7". This, of course, is... um... accidentally and
unfortunately misleading, in itself, because GPLv3 section 7 is not
about attribution provisions. It is about required legal notices
(e.g., trademark) and other permitted supplementary terms. Clause 7b
says that "Requiring preservation of specified reasonable legal
notices or author attributions in that material or in the Appropriate
Legal Notices displayed by works containing it" are permitted, but I
very much doubt that FSF had in mind required, immutable runtime
display of trademarked logos and advertising on every user interface
screen of the program and all derivatives -- which has the obvious
effect of severely impairing freedom of third-party commercial use.

> [1] In the name of full disclosure, this trickery is mentioned in
> passing in the "SugarCRM GPL v3 FAQ",
> http://www.sugarforge.org/content/faq/gplv3.php, which claims that
> "Sugar Community Edition conforms to the attribution provisions in GPL
> v3 Section 7". This, of course, is... um... accidentally and
> unfortunately misleading, in itself, because GPLv3 section 7 is not
> about attribution provisions. It is about required legal notices
> (e.g., trademark) and other permitted supplementary terms. Clause 7b
> says that "Requiring preservation of specified reasonable legal
> notices or author attributions in that material or in the Appropriate
> Legal Notices displayed by works containing it" are permitted, but I
> very much doubt that FSF had in mind required, immutable runtime
> display of trademarked logos and advertising on every user interface
> screen of the program and all derivatives -- which has the obvious
> effect of severely impairing freedom of third-party commercial use.

Relevant to that, here's what I wrote to Bruce Perens in the context of
a private discussion between us _Linux Gazette_ staffers and Bruce:

> [RM: Redacting an opinion Bruce stated, which I've not asked his
> permission to quote]

They fit it in as an allegedly "specified reasonable legal notice or
author attribution" under GPLv3 clause 7b:
7. Additional Terms.
[...]
Notwithstanding any other provision of this License, for material you
add to a covered work, you may (if authorized by the copyright holders
of that material) supplement the terms of this License with terms:
[...]
b) Requiring preservation of specified reasonable legal notices or
author attributions in that material or in the Appropriate Legal
Notices displayed by works containing it;
SugarCRM, Inc. specifically imposes this clause within the
SugarCE-5.0.0a.zip (Community Edition) package ("About" file):
* The interactive user interfaces in modified source and object code versions
* of this program must display Appropriate Legal Notices, as required under
* Section 5 of the GNU General Public License version 3.
*
* In accordance with Section 7(b) of the GNU General Public License version 3,
* these Appropriate Legal Notices must retain the display of the "Powered by
* SugarCRM" logo. If the display of the logo is not reasonably feasible for
* technical reasons, the Appropriate Legal Notices must display the words
* "Powered by SugarCRM".
I wonder whether FSF concurs that a trademarked logo required to remain on
every user interface screen at runtime qualifies as a "reasonable author
attribution" -- the genuine need for attribution having always been
amply met by comment lines in source code. As I've said before, this
isn't attribution; it's mandatory runtime advertising.
As usual in prior badgeware licences (such as SugarCRM's "SPL"), this is
tied to an implied threat of trademark litigation, made somewhat more
explicit by the trademark policy on
http://www.sugarcrm.com/crm/open-source/trademark-information.html .
Authorized Use of SugarCRM Inc. Marks.
A. SugarCRM Inc. "Conditional Use" Logos
SugarCRM Inc. has developed a family of "Conditional Use" Logos for
those who wish to show their support for SugarCRM Inc. and its products
and services by displaying such a logo in the user interface of a
website. The "Conditional Use" Logos may be used without specific
written permission from SugarCRM Inc. under the following conditions:
* The use must not be detrimental, i.e., harmful or damaging, to the
value of any of the SugarCRM Inc. Marks, or to SugarCRM, its brand
integrity, reputation or goodwill, as determined by SugarCRM Inc.
in its sole discretion;
* The "Conditional Use" Logo must be a "clickable" link that leads
directly to http://www.sugarcrm.com/.
* If the website has password-protected areas, the "Conditional Use"
Logo must be placed only in areas that are not password-protected
* If used in an application released under the GPL, LGPL, MPL, SPL
(Sugar Public License) or any other Open Source Initiative
(http://www.opensource.org) recognized open source license, the
application must be able to connect directly to a SugarCRM server
* The limited license given herein does not include the right to use
any SugarCRM "Conditional Use" Logo or any other SugarCRM Inc.
Logo as a trademark to promote your own products or services. For
example, no SugarCRM Inc. Logo may be used on any product
packaging or documentation, such as (without limitation) on CD-ROM
or diskette labels or packaging, books or other publications. Any
such use must be expressly authorized by SugarCRM Inc. in a
signed, written agreement;
* The use of any SugarCRM Inc. "Conditional Use" Logo under this
Section 1(A) must also comply with applicable provisions of this
Trademark Policy, including (without limitation) Sections 2 and 3
The SugarCRM Inc. "Conditional Use" Logos:
[RM: shows a copy of the "Powered by SugarCRM" image -- the one mandated
by the badgeware clause]
SugarCRM Inc. reserves the right to revoke this authorization at any
time in its sole discretion. For example, if SugarCRM Inc. believes that
your use of any SugarCRM Inc. "Conditional Use" Logo is detrimental to
any of the SugarCRM Marks or is otherwise unacceptable, SugarCRM Inc.
will revoke this authorization. Upon revocation of this authorization by
SugarCRM Inc., you shall immediately cease using any and all SugarCRM
Inc. "Conditional Use" Logo. If you do not immediately cease using all
SugarCRM Inc. "Conditional Use" Logos upon revocation by SugarCRM,
SugarCRM Inc. may take whatever action it deems necessary to protect its
rights and interests. Although as a general rule you must never modify
the design, add or delete any words, or change any colors when using a
SugarCRM Inc. "Conditional Use" Logo, you may adjust the overall size of
the logo, so long as adjustments are made proportionally.
Although it can be certainly argued that a trademarked image you're
required to display is one that one doesn't need permission for,
I think SugarCRM, Inc.'s implied legal threat and attempt to
impair/dissuade all third-party commercial usage is abundantly clear.
(SugarCRM, Inc. policy seems to still be dictated by their blunder of
not realising that open source permits commercial-usage forks, and their
consequent outrage when they learned that vTiger had taken them at their
word.)